Elastic Defend high stable eql

Suspicious Shell Extension Handler Registry Modification

Identifies registry modification consistent with the SolarMarker Backdoor installer that registers a rogue custom shell extension handler which runs a PowerShell command when a file with a matching extension is opened.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and 
   (
    process.name : ("reg.exe", "powershell.exe", "msiexec.exe", "rundll32.exe", "regsvr32.exe") or
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
    (process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300)
    )]
 [registry where
  registry.path : ("HKEY_USERS\\S-1-5-21-*Classes\\*\\shell\\open\\command*", "HKEY_USERS\\S-1-12-1-*Classes\\*\\shell\\open\\command*") and

  /* Command value contains PowerShell and its length is greater or equal than 200 chars */
  registry.data.strings : ("*PowerShell*", "*SyncAppvPublishingServer*", "*cmd.exe *", "*FromBase64String*") and length(registry.data.strings) >= 200]

Field Validations

Loading…

Comments (0)

Loading comments...